IPTABLES - Route all incoming IP requests through another IP on a different network

Question

I need help with iptables to allow all requests come from one single IP.

Server1 IP : 1.1.1.1 [Dedicated Server]

Server2 IP : 2.2.2.2. [VPS Server]

Both Servers are running Ubuntu, and are NOT on the same network.

I have service running on Server1 on port 1234. I want all traffic to come to server1 only from server2. And, if a request is received by Server1 directly, instead of killing/dropping the request, is it possible for server1 to forward the request to Server2, and have server2 send it to server1.

On Server2 I have:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 1.1.1.1:1234
iptables -t nat -A POSTROUTING -j MASQUERADE

On Server1 where the service is running, I have:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -I INPUT -p tcp -s 2.2.2.2 --dport 1234 -j ACCEPT

The Server2 is redirecting requests fine to Server1. Can you help me with iptables command for Server1, to route all other incoming IP requests through server2?

Thank you.

Answer 1

your question is not clear?

I can't understand what you want exactly

but what I got it that you have two server, and you have a running service on server1

you need to access this service only from server2 and not directly to server1 like the following:

request --> 1.1.1.1:1234 (drop)
request --> 2.2.2.2:1234 --> 1.1.1.1:1234 (accept)

for that you need to do the following rules:

server1:

accept incoming traffic to port 1234 from 2.2.2.2

drop other incoming traffic to port 1234

iptables -I INPUT -p tcp -s 2.2.2.2 --dport 1234 -j ACCEPT
iptables -I INPUT -p udp -s 2.2.2.2 --dport 1234 -j ACCEPT

iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 1234 -j DROP
iptables -I INPUT -p udp -s 0.0.0.0/0 --dport 1234 -j DROP

server2:

redirection rules:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 1.1.1.1:1234
iptables -t nat -A POSTROUTING -j MASQUERADE